Renewal

Move from an expiring certificate to a certificate that is issued, deployed and actually verified on the target service.

1. Before renewal

Confirm the certificate, domain ownership, validation path and issuance provider. A discovered certificate is not automatically an asset that should be renewed.

2. DNS account

Where DNS validation is used, configure the organization, provider type, account name, authentication mode, required provider credentials, optional zone identifier and active state through the secure DNS account form.

3. Policy

A Renewal policy defines when to act and what action to take. Trigger types include days before expiry, risk level, domain validation and manual only. Actions include auto-renew, notify only, manual review and domain validation.

4. Workflow

Workflow step types include domain validation, certificate request, provider approval, installation test, notification and custom script. Each step has order, required/optional state and timeout.

5. Run

Run active policies or execute one policy immediately. Processing is asynchronous and history records are created for operational tracking.

6. History

History tracks certificate, policy, actor, status, current step, progress, start/end, success, errors, old/new certificate data, validation data and workflow log.

7. Deployment verification

Issuance and deployment are separate states. Ecurem CLM can verify whether the expected certificate is actually observable on TLS after issuance.

8. Bulk renewal

The bulk form uses Certificates, Policy and Force renewal. It queues an asynchronous task and directs the user to Renewal history.

9. Troubleshooting

• Validation failed: fix DNS/HTTP/provider access.
• Certificate request failed: verify provider and policy inputs.
• Certificate available not deployed: issuance succeeded but target service is not serving it.
• No new execution: another compatible execution may already be active.